Users have to transmit the private keys to their nodes, but not the PIN. This tradeoff was taken to prevent people from losing their money by losing their phone

Users have to transmit the private keys to their nodes, but not the PIN. This tradeoff was taken to prevent people from losing their money by losing their phone. If the secure enclave were broken, nodes could, theoretically, be able to brute-force the private keys. I think that in reality, there will really be just a few nodes: Signal, WhatsApp and some bots/banks/businesses. The trust system in place is ideal for this.